Merge pull request #1484 from splunk/automated_detections_testing_2

bug fix detection testing

automated_detection_testing/ci/detection_testing_batch/detection_testing_execution.py

@@ -2,6 +2,7 @@ import sys
 import argparse
 import shutil
 import os
+import time
 
 from modules.github_service import GithubService
 from modules import aws_service, testing_service
@@ -25,23 +26,21 @@ def main(args):
 
     github_service = GithubService(branch)
     test_files = github_service.get_changed_test_files()
-    for test_file in test_files:
-        print(test_file)
+    if len(test_files) == 0:
+        print("No new detections to test.")
+        aws_service.dynamo_db_nothing_to_test(REGION, uuid_test, str(int(time.time())))
+        sys.exit(0)
 
-    # dt_ar = aws_service.get_ar_information_from_dynamo_db(REGION, DT_ATTACK_RANGE_STATE)
-    # splunk_instance = aws_service.get_splunk_instance(REGION, dt_ar['ssh_key_name'])
+    dt_ar = aws_service.get_ar_information_from_dynamo_db(REGION, DT_ATTACK_RANGE_STATE)
+    splunk_instance = aws_service.get_splunk_instance(REGION, dt_ar['ssh_key_name'])
 
-    # splunk_ip = splunk_instance['NetworkInterfaces'][0]['Association']['PublicIp']
-    # splunk_password = dt_ar['password']
-    # ssh_key_name = dt_ar['ssh_key_name']
-    # private_key = dt_ar['private_key']
+    splunk_ip = splunk_instance['NetworkInterfaces'][0]['Association']['PublicIp']
+    splunk_password = dt_ar['password']
+    ssh_key_name = dt_ar['ssh_key_name']
+    private_key = dt_ar['private_key']
 
-    # testing_service.prepare_detection_testing(ssh_key_name, private_key, splunk_ip, splunk_password)
-    # testing_service.test_detections(ssh_key_name, private_key, splunk_ip, splunk_password, test_files, uuid_test)
-
-    # Get Password, private_key and key_name from DynamoDB
-    # For loop
-        # Detection Test
+    testing_service.prepare_detection_testing(ssh_key_name, private_key, splunk_ip, splunk_password)
+    testing_service.test_detections(ssh_key_name, private_key, splunk_ip, splunk_password, test_files, uuid_test)
 
 
 if __name__ == "__main__":

automated_detection_testing/ci/detection_testing_batch/modules/aws_service.py

@@ -1,5 +1,5 @@
 import boto3
-
+import uuid
 
 
 
@@ -39,6 +39,18 @@ def get_splunk_instance(region, key_name):
     return {}
 
 
+def dynamo_db_nothing_to_test(region, uuid_test, time):
+    uuid_var = str(uuid.uuid4())
+    resource = boto3.resource('dynamodb', region_name=region)
+    table = resource.Table("dt-results")
+    response = table.put_item(Item= {
+        'uuid': uuid_var, 
+        'uuid_test': uuid_test,
+        'time': time,
+        'status': 'nothing to test'
+    })  
+
+
 def add_detection_results_in_dynamo_db(region, uuid, uuid_test, detection, detection_path, time):
     resource = boto3.resource('dynamodb', region_name=region)
     table = resource.Table("dt-results")

automated_detection_testing/ci/python_ci_code/main.py

@@ -44,8 +44,13 @@ def main(args):
             }
         )        
 
+
         test_done = True
         for item in response['Items']:
+            if item['status']['S'] == 'nothing to test':
+                print('No new or changed detections to test.')
+                sys.exit(0)
+
             if item['status']['S'] == 'running':
                 test_done = False
 

detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -50,5 +50,3 @@ tags:
   - Processes.process
   - Processes.dest
   security_domain: endpoint
-
-